Arbitrary File Inclusion Vulnerability Affects Category Ajax Filter Plugin for WordPress
CVE-2024-10871

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Category Ajax Filter
Vendor
CVE Published:
9 November 2024

Summary

The Category Ajax Filter plugin for WordPress is prone to a Local File Inclusion vulnerability via the 'params[caf-post-layout]' parameter. This flaw affects all versions up to and including 2.8.2, allowing unauthenticated attackers to include and execute arbitrary files on the server. This exploitation can facilitate the execution of PHP code found within the included files, potentially bypassing access controls, revealing sensitive information, or allowing the upload and inclusion of harmful PHP files.

Affected Version(s)

Category Ajax Filter * <= 2.8.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/category-ajax-...
https://plugins.trac.wordpress.org/changeset/3183800/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ngocanh le
.